A sanctions program at fifty employees: what OFAC’s Framework actually asks for.

What OFAC actually asks for, what it does not, and how much of it is proportionate when there is no compliance department.

Foundations · 02 Sep 2026

A company with fifty employees may have one finance director, international customers and no separate compliance department. Its sanctions program should reflect its actual exposure and resources. OFAC's Framework expressly recognizes differences in size, sophistication, products, counterparties and geography. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), p. 1.

Start with a sentence from OFAC's own guidance that is easy to overlook:

OFAC regulations do not require a formal SCP; however, OFAC encourages organizations subject to U.S. jurisdiction …, and particularly those that engage in international trade or transactions or possess any clients or counter-parties located outside of the United States, to adopt a formal SCP.

OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), p. 9, Root Cause I.

That statement concerns a formal OFAC sanctions compliance program generally. It does not excuse prohibited transactions or displace separate sector-specific duties, license conditions or settlement commitments. Nor does it displace OFAC's own binding rules, such as the requirement to keep a full and accurate record of each transaction subject to OFAC's regulations for at least 10 years. 31 C.F.R. § 501.601. OFAC's guidance explains why an effective program can matter in enforcement.

Why you build one anyway

OFAC says an effective program can affect its enforcement assessment in three ways. These are discretionary considerations, not promised penalty reductions. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), p. 1.

General Factor E considers the existence, nature and adequacy of the risk-based program at the time of the apparent violation. 31 C.F.R. pt. 501, app. A, § III.E.
General Factor F considers remedial action, including correction of the conduct and enhancement of controls. Effective remediation can support mitigation; it is not an automatic second discount. 31 C.F.R. pt. 501, app. A, § III.F.
An effective program may also inform egregiousness. The Guidelines give substantial weight to Factors A–D, with particular emphasis on willfulness or recklessness and awareness. Program quality does not determine that classification alone. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), p. 1; 31 C.F.R. pt. 501, app. A, § V.B.1.

A program can reduce risk and help explain the company's conduct if a violation occurs. It cannot guarantee a particular enforcement outcome.

"Risk-based" is a license to be proportionate

The word does real work, and the guidance is explicit that scale is a legitimate input:

While each risk-based SCP will vary depending on a variety of factors—including the company's size and sophistication, products and services, customers and counterparties, and geographic locations—each program should be predicated on and incorporate at least five essential components of compliance: (1) management commitment; (2) risk assessment; (3) internal controls; (4) testing and auditing; and (5) training.

OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), p. 1.

Both parts describe OFAC's recommended framework. Size informs proportionality, while all five components remain part of the model. This is guidance about an effective program, not a free-standing legal mandate to adopt every listed measure.

The five components, translated

Component	Illustrative larger organization	Illustrative smaller organization
Management commitment	A dedicated sanctions compliance officer, direct board reporting lines, a resourced unit	A named, appropriately qualified owner with authority and access to senior management; another senior compliance role may be combined where suitable. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), p. 2 & n.1
Risk assessment	Enterprise-wide assessment with differentiated customer, product and geographic risk	A written assessment of counterparties, products/services and geography, with a documented review cadence and event triggers. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), pp. 3–5
Internal controls	Screening engines, automated interdiction, escalation workflow, retention systems	Written procedures someone can actually follow, a screening step that happens before money moves, one named escalation route, and records kept. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), pp. 5–6
Testing and auditing	An independent internal audit function	An objective, independent check proportionate to risk; external testing is permitted by the guidance. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), pp. 6–7
Training	Role-based curricula, tracked completions, assessments	Training for relevant staff, at least annually as recommended by the Framework, tailored to their responsibilities. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), pp. 7–8

The footnote that makes this affordable

Management commitment is the component that sounds like a headcount you do not have. The guidance measures that commitment in part by whether the organization "has appointed a dedicated OFAC sanctions compliance officer," and then attaches a footnote:

This may be the same person serving in other senior compliance positions, e.g., the Bank Secrecy Act Officer or an Export Control Officer, as many institutions, depending on size and complexity, designate a single person to oversee all areas of financial crimes or export control compliance.

OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), p. 2 n.1.

The footnote contemplates combining the sanctions officer role with other senior compliance responsibilities. It does not establish that any finance employee is automatically qualified or that minimal resources suffice. On the same page, OFAC measures commitment by the "quality and experience of the personnel dedicated to the SCP," and asks senior management to give the compliance function "sufficient authority and autonomy," "direct reporting lines between the SCP function and senior management," and "adequate resources." OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), p. 2, Management Commitment II–III, criteria A–B and n.1.

It also asks for something no budget line buys — a culture in which people can speak. The measure offered is "the ability of personnel to report sanctions related misconduct by the organization or its personnel to senior management without fear of reprisal," and oversight that reaches "the entire organization, including but not limited to senior management." A program the managing director is exempt from is not one of these. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), p. 3, Management Commitment IV.

The risk assessment is the one thing to get right first

OFAC describes the results of a risk assessment as "integral in informing the SCP's policies, procedures, internal controls, and training." It calls for "a holistic review of the organization from top-to-bottom" that assesses "its touchpoints to the outside world," and gives, as an example, three areas: (1) people and relationships—customers, supply chain, intermediaries and counterparties; (2) products and services, including how they fit into wider financial or commercial systems; and (3) geography—the organization's locations and those of the relevant parties. The first area groups several categories of relationship; they are not separate areas. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), p. 3, Risk Assessment.

OFAC also highlights mergers and acquisitions, and points to the risk matrix in the Annex to Appendix A to part 501. The Framework says the matrix "may be used by financial institutions or other entities," but the Annex itself introduces it as a tool for financial institutions, and its factors show it: customer base, high-risk customers, overseas branches and correspondent accounts, funds-transfer volume, other international transactions, history of OFAC actions, management commitment, staffing and training. A manufacturer can adapt relevant prompts; the matrix is not a ready-made scorecard or safe harbor for every business. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), pp. 3–4; 31 C.F.R. pt. 501, app. A, Annex.

Set a cadence and event triggers

The Framework recommends a frequency that accounts for the organization's risks and updates, as appropriate, for apparent violations or systemic deficiencies. Treat those events as review triggers in the company's procedures; do not call the guidance itself a universal statutory duty. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), pp. 4–5, Risk Assessment I–II.

The root causes are the real syllabus

The Framework's non-exhaustive root-cause list offers practical training topics for organizations of different sizes. The following examples are relevant to a smaller cross-border group; OFAC does not label them a distinct mid-cap category. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), pp. 9–12.

Misinterpreting applicability (Root Cause II). Organizations that "determined the transaction, dealing, or activity at issue was either not prohibited or did not apply to their organization," including by failing to appreciate that sanctions applied through dealings with U.S. persons, the U.S. financial system, or U.S.-origin goods and technology. OFAC notes this root cause typically travels with aggravating factors — "reckless conduct, the presence of numerous warning signs." OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), p. 9, Root Cause II.
Facilitating transactions by non-U.S. persons (Root Cause III). Referring business opportunities to, approving or signing off on transactions conducted by, or otherwise facilitating dealings between an organization's non-U.S. locations and sanctioned countries, regions or persons. If you have read this firm's note on facilitation, this is the same failure seen from OFAC's side. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), pp. 9–10, Root Cause III.
Screening software and filter faults (Root Cause VI). Failing to update for list changes, omitting identifiers such as SWIFT codes, and — the one that should embarrass any European operation — not accounting for "alternative spellings of prohibited countries or parties," OFAC's own examples being "Habana instead of Havana, Kuba instead of Cuba, Soudan instead of Sudan." OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), p. 11, Root Cause VI.
Ownership due diligence (Root Cause VII). Incomplete information about ownership, geography, counterparties and transactions can undermine controls. This connects directly to the ownership-screening issue discussed in the companion 50 Percent Rule explainer. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), p. 11, Root Cause VII.
De-centralized compliance (Root Cause VIII). "[P]ersonnel and decision-makers scattered in various offices or business units," producing inconsistent application, no formal escalation process, and miscommunication. A group of three small companies with one policy and no owner is this root cause. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), p. 11, Root Cause VIII.
Non-standard payment or commercial practices (Root Cause IX). OFAC says organizations subject to U.S. jurisdiction "are in the best position to determine whether a particular dealing … is proposed or processed in a manner that is consistent with industry norms." When a counterparty proposes something odd about payment routing, that oddity is the signal. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), p. 11, Root Cause IX.

Root Cause X is individual liability, and it is recorded here because OFAC records it: in cases involving U.S.-owned or controlled entities abroad, supervisory, managerial or executive employees have caused violations "notwithstanding the fact that the U.S. entity had a fulsome sanctions compliance program in place," sometimes concealing activity from their own compliance personnel. OFAC says it "will consider using its enforcement authorities not only against the violating entities, but against the individuals as well." That is stated as a reason to build controls the organization can see through — nothing in this piece addresses representing any individual. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), p. 12, Root Cause X.

What good looks like, and what it is not

A defensible program at this size is a small number of documents that match what the company does:

a dated risk assessment,
written procedures a new joiner could follow,
a named owner with a reporting line,
a screening step that happens before value moves,
a record of annual training,
and evidence that somebody independent looked at it.

The Framework recommends controls that can respond promptly to relevant list, program and license changes. Assign responsibility for tracking those changes and updating the procedures and screening process. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), p. 5, Internal Controls.

For a small organization, separate legal interpretation from daily operation. Counsel can help assess U.S. sanctions requirements and the controls they call for; the engagement should identify who performs screening, resolves operational alerts, approves transactions and maintains records. Outsourcing advice does not itself allocate those operating responsibilities.

A defined next step

Contact Zimmermann Law to discuss a defined review of U.S. sanctions exposure and screening or monitoring procedures, or appropriately scoped ongoing compliance coverage. A separate Fractional Chief Compliance Officer engagement has a distinct scope; it should not be confused with limited monitoring support or a bounded program build. Any engagement is subject to agreed scope, conflicts checks and availability.

OFAC recommends reviewing its published settlements when reassessing controls. A useful routine is to ask whether the reported failure could occur in your process and what evidence would reveal it. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), p. 1; settlements are listed on OFAC, Civil Penalties and Enforcement Information.

A program at this size is a small number of documents that match what the company actually does — built once, on a fixed scope, and then handed over. Contact Zimmermann Law to talk it through.

Sources: Checked September 25, 2026. OFAC's Framework is persuasive U.S. agency guidance, not a general legal obligation to adopt an SCP. Appendix A is codified enforcement guidance. The binding transaction prohibitions and OFAC's recordkeeping rule remain separate. OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), pp. 1–12. 31 C.F.R. pt. 501, app. A, §§ III.E–F, V.B.1 and Annex — codified enforcement framework (Economic Sanctions Enforcement Guidelines). 31 C.F.R. § 501.601 — mandatory U.S. federal recordkeeping requirement (10 years). The table presents editorial implementation examples, not OFAC staffing mandates. Its anchors are OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), pp. 2–8. OFAC, Revised Guidance on Entities Owned by Persons Whose Property and Interests in Property Are Blocked (Aug. 13, 2014) — background to Root Cause VII. 31 C.F.R. § 560.208 — mandatory U.S. federal facilitation prohibition (Iran program); background to Root Cause III. OFAC, Civil Penalties and Enforcement Information — OFAC's published enforcement actions and settlements.

This post is for general information and is not legal advice.

Attorney Advertising. Zimmermann Law PLLC · New York · +1 (917) 426-4625 · contact@zimmermann-law.com